CVE-2022-2638

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be the CSV file. This could allow high privilege users to delete arbitrary file from the server

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-73 CWE-610

Affected software

No affected versions have been published.

Timeline

Published: Aug 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-263807.5A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X CVE-2022-263818.8An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash. This vu CVE-2022-263824.3While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel at CVE-2022-263834.3When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This vulnerability affect CVE-2022-263849.6If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scripts</code>, they wer CVE-2022-263856.5In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to a use-after-free cau CVE-2022-263866.5Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior w CVE-2022-263877.5When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the under CVE-2022-263886.4A use of hard-coded password vulnerability may allow authentication abuse.This issue affects ELI 380 Resting Electrocardiograph: Versions CVE-2022-263897.7An improper access control vulnerability may allow privilege escalation.This issue affects: * ELI 380 Resting Electrocardiograph: Vers CVE-2022-26397.8An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, while copying and reserv CVE-2022-263904.2The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto progra